Email: 293137 Autolearn: 0 AvgScore: 4.88 AvgScanTime: 1.14 sec Spam: 109445 Autolearn: 0 AvgScore: 14.24 AvgScanTime: 1.18 sec Ham: 183692 Autolearn: 0 AvgScore: -0.70 AvgScanTime: 1.12 sec Time Spent Running SA: 92.95 hours Time Spent Processing Spam: 35.73 hours Time Spent Processing Ham: 57.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 103672 86.79 94.73 82.06 2 DKIM_SIGNED 98148 80.99 89.68 75.81 3 XM_DK_Pass 95807 79.56 87.54 74.80 4 XM_B_Unicode 94948 76.21 86.75 69.93 5 DKIM_VALID 93838 78.59 85.74 74.34 6 T_SCC_BODY_TEXT_LINE 89227 82.78 81.53 83.52 7 DCC_CHECK 84145 55.24 76.88 42.34 8 RELAYCOUNTRY_US 82962 77.05 75.80 77.79 9 XMListUnsubscribeExists 82019 63.52 74.94 56.72 10 XM_B_SpammyWords 81812 54.69 74.75 42.74 11 DKIM_VALID_AU 69587 63.47 63.58 63.41 12 XM_DK_Undo_02 55408 23.34 50.63 7.08 13 XM_B_Unicode3 49588 44.97 45.31 44.77 14 XM_B_SpammyWords2 46159 28.09 42.18 19.69 15 TR_XM_DKIM_Undo 45168 16.99 41.27 2.53 16 BAYES_99 43614 18.72 39.85 6.13 17 LOC_TINY_FONT_1 42625 32.99 38.95 29.44 18 HTML_FONT_LOW_CONTRAST 39414 36.12 36.01 36.19 19 MIME_HTML_ONLY 37690 25.08 34.44 19.51 20 BAYES_50 37338 47.47 34.12 55.43 21 DKIM_VALID_EF 35643 29.97 32.57 28.41 22 FVGT_m_MULTI_ODD 35382 29.11 32.33 27.19 23 BAYES_999 34528 14.75 31.55 4.75 24 TR_DCC_Bayes_99 33173 12.95 30.31 2.61 25 TR_XM_DK_Unsub 28490 19.95 26.03 16.33 26 T_KAM_HTML_FONT_INVALID 27389 21.24 25.03 18.99 27 RELAYCOUNTRY_META 26380 11.43 24.10 3.88 28 DCC_CHECK_NEGATIVE 25284 44.75 23.10 57.64 29 RCVD_IN_MSPIKE_H2 25234 23.05 23.06 23.05 30 TR_XM_SpammyRelay 22516 9.26 20.57 2.52 31 XMSubLong 22308 20.82 20.38 21.09 32 T_TM2_M_HEADER_IN_MSG 21618 19.90 19.75 19.98 33 XM_Multi_Part_URI 19559 16.61 17.87 15.86 34 RCVD_IN_BL_SPAMCOP_NET 18376 6.70 16.79 0.69 35 TR_XM_SpammyWords2 17348 6.34 15.85 0.67 36 RELAYCOUNTRY_CA 17284 6.91 15.79 1.61 37 BOTNET_IPINHOSTNAME 15457 8.99 14.12 5.93 38 UNPARSEABLE_RELAY 15429 12.10 14.10 10.91 39 TR_XM_SPAMCOP 15268 5.43 13.95 0.35 40 XM_B_Unsub 14942 9.94 13.65 7.72 41 TR_XM_BayesUnsub 14537 9.03 13.28 6.49 42 RCVD_IN_MSPIKE_H3 14458 9.11 13.21 6.67 43 RCVD_IN_MSPIKE_WL 14458 9.11 13.21 6.67 44 XM_B_SpammyWords3 14201 8.25 12.98 5.43 45 LOTS_OF_MONEY 14024 7.95 12.81 5.05 46 XM_Body_Dirty_Words 13191 8.09 12.05 5.73 47 TR_XM_SpammyWords4 12372 6.46 11.30 3.58 48 FSL_BULK_SIG 10421 5.44 9.52 3.01 49 BOTNET 10353 4.23 9.46 1.12 50 BAYES_80 9845 7.08 9.00 5.94 51 XM_Evil_Numbers_Gen 9059 8.71 8.28 8.96 52 TR_XM_UnparsRelay 8595 4.16 7.85 1.95 53 BAYES_60 8537 10.67 7.80 12.38 54 XMBody_17 8513 3.45 7.78 0.88 55 HTML_IMAGE_RATIO_02 8108 7.01 7.41 6.77 56 XM_UncommonTLD01 7872 5.62 7.19 4.69 57 XMSubMetaSx_00 7589 5.67 6.93 4.92 58 HTML_IMAGE_RATIO_04 7046 5.34 6.44 4.69 59 TR_XM_BayesRelay 6675 2.28 6.10 0.00 60 XMSexyCombo_05 6631 3.54 6.06 2.04 61 UNTRUSTED_Relay 6593 3.46 6.02 1.94 62 BAYES_95 6382 4.44 5.83 3.61 63 T_FILL_THIS_FORM_SHORT 6281 2.39 5.74 0.40 64 HTML_IMAGE_RATIO_06 6126 3.93 5.60 2.94 65 MPART_ALT_DIFF 6118 6.68 5.59 7.33 66 HK_RANDOM_REPLYTO 5767 2.03 5.27 0.09 67 TR_XM_SpammyWords5 5748 2.93 5.25 1.55 68 TooManyTo_001 5723 5.58 5.23 5.79 69 XM_OfRef6 5640 2.46 5.15 0.86 70 RCVD_IN_VALIDITY_SAFE 5620 7.01 5.13 8.12 71 LotsOfNums_01 5561 6.60 5.08 7.50 72 XM_B_SpammyTLD 5134 3.56 4.69 2.88 73 SpammyFromTLD_01 4915 2.02 4.49 0.54 74 XMStrtUSub 4838 5.20 4.42 5.67 75 XM_H_Long_From01 4761 4.45 4.35 4.50 76 XM_H_GMP 4699 6.18 4.29 7.31 77 RCVD_IN_VALIDITY_CERTIFIED 4683 6.14 4.28 7.25 78 XM_B_Phish_Phrases 4430 3.96 4.05 3.91 79 XM_SPF_SoftFail 4347 2.84 3.97 2.17 80 DKIM_INVALID 4310 2.40 3.94 1.48 81 TR_XM_PhishingBody 4180 2.65 3.82 1.96 82 TR_XM_FormFill 4095 1.41 3.74 0.02 83 T_XMDrugObfuBody_14 4079 2.87 3.73 2.36 84 TR_LOTS_OF_MONEY3 4046 1.78 3.70 0.64 85 MIME_HTML_MOSTLY 4043 5.12 3.69 5.97 86 XM_B_Investor 4018 2.17 3.67 1.27 87 MIME_HTML_ONLY_MULTI 3983 2.89 3.64 2.44 88 XMNumbers 3852 3.39 3.52 3.31 89 FONT_INVIS_LONG_LINE 3713 1.30 3.39 0.06 90 USER_IN_DEF_DKIM_WL 3709 12.28 3.39 17.58 91 TM2_M_URI_OPT_OUT 3589 2.45 3.28 1.95 92 HTML_IMAGE_RATIO_08 3467 2.48 3.17 2.07 93 SUBJ_ALL_CAPS 3327 1.72 3.04 0.94 94 TM2_M_VERY_LONG_WORD 3285 2.07 3.00 1.51 95 XM_URI_RBL 3217 1.22 2.94 0.20 96 AC_BR_BONANZA 3170 1.20 2.90 0.18 97 XM_CamelCaseFrm001 3059 2.44 2.80 2.23 98 T_XMDrugObfuBody_08 3026 2.07 2.76 1.66 99 TR_Mismatch_TLD_02 3007 1.11 2.75 0.14 100 T_XMHurry_00 2950 1.51 2.70 0.81 101 XMBrknScrpt_02 2941 1.32 2.69 0.50 102 XM_B_SpammyWords4 2846 1.55 2.60 0.93 103 RELAYCOUNTRY_AU 2705 1.17 2.47 0.40 104 XM_UB50 2568 1.53 2.35 1.04 105 FROM_EXCESS_BASE64 2468 2.62 2.26 2.84 106 XMPhish30 2407 1.43 2.20 0.97 107 RCVD_IN_PSBL 2328 1.05 2.13 0.41 108 KHOP_HELO_FCRDNS 2267 1.07 2.07 0.47 109 HTML_TAG_BALANCE_BODY 2247 1.17 2.05 0.64 110 XM_HighProb1 2197 0.75 2.01 0.00 111 XMReplyNow 2176 0.90 1.99 0.25 112 TR_XM_PHPForged 2104 0.85 1.92 0.22 113 TR_XM_PHPDW 2100 0.85 1.92 0.22 114 XM_DIRTYINTL 2098 0.84 1.92 0.20 115 T_TooManySym_01 2078 4.57 1.90 6.16 116 BOTNET_NORDNS 2068 0.71 1.89 0.01 117 MPART_ALT_DIFF_COUNT 2062 1.46 1.88 1.20 118 TR_XM_FormFill2 2035 0.83 1.86 0.22 119 XM_H_PHPOS 2022 0.80 1.85 0.18 120 T_MONEY_PERCENT 1925 0.76 1.76 0.17 121 TR_LOTS_OF_MONEY2 1925 0.76 1.76 0.17 122 XMDiploma_00 1914 1.63 1.75 1.56 123 TR_XM_NoHeaderRelay 1913 0.72 1.75 0.11 124 XMStockSpam_06 1869 1.71 1.71 1.72 125 XMSubMetaI_00 1860 1.59 1.70 1.52 126 MIME_QP_LONG_LINE 1849 2.66 1.69 3.24 127 URI_TRY_3LD 1808 1.03 1.65 0.67 128 T_REMOTE_IMAGE 1777 2.15 1.62 2.46 129 THIS_AD 1738 1.01 1.59 0.67 130 TR_XM_INV_DKIM 1693 0.61 1.55 0.06 131 XM_B_Unsub2 1676 1.21 1.53 1.02 132 XMBdyGiftCard01 1647 1.47 1.50 1.46 133 DIET_1 1629 0.81 1.49 0.41 134 BAYES_40 1590 2.97 1.45 3.87 135 SHOPIFY_IMG_NOT_RCVD_SFY 1586 0.82 1.45 0.44 136 PDS_OTHER_BAD_TLD 1575 0.69 1.44 0.24 137 URI_HEX 1570 1.25 1.43 1.14 138 HTML_MIME_NO_HTML_TAG 1569 1.25 1.43 1.14 139 SpammyFromTLD_02 1536 0.64 1.40 0.19 140 HELO_NODOT 1525 0.75 1.39 0.36 141 HELO_NO_DOMAIN 1521 0.74 1.39 0.36 142 MAILING_LIST_MULTI 1513 1.62 1.38 1.76 143 TR_XM_InvalidRelay 1504 0.53 1.37 0.03 144 FSL_HELO_NON_FQDN_1 1467 0.50 1.34 0.00 145 RCVD_IN_VALIDITY_RPBL 1450 0.52 1.32 0.04 146 XMSexyCombo_01 1439 0.71 1.31 0.35 147 T_XMDrugObfuBody_10 1384 0.48 1.26 0.02 148 XM_SendGrid 1357 1.27 1.24 1.29 149 XM_H_PHPMailer 1324 1.01 1.21 0.89 150 XM_ProductURIs 1317 0.91 1.20 0.73 151 TR_Caps_n_Bayes_99 1317 0.47 1.20 0.03 152 REPTO_INFONUMSCOM 1287 0.44 1.18 0.00 153 BOUNCE_MESSAGE 1279 3.95 1.17 5.60 154 ANY_BOUNCE_MESSAGE 1279 3.95 1.17 5.60 155 HTTPS_HTTP_MISMATCH 1271 0.73 1.16 0.48 156 FROM_MISSP_REPLYTO 1268 0.43 1.16 0.00 157 ALL_TRUSTED 1262 11.93 1.15 18.35 158 XM_H_Long_From02 1259 0.97 1.15 0.86 159 XM_DK_Undo_01 1244 1.46 1.14 1.65 160 T_XMDrugObfuBody_00 1213 0.75 1.11 0.53 161 HOSTED_IMG_MULTI_PUB_01 1198 0.41 1.09 0.00 162 RDNS_DYNAMIC 1186 0.62 1.08 0.34 163 BAYES_20 1177 2.11 1.08 2.72 164 XMSolicitRefs_0 1161 0.51 1.06 0.19 165 XM_H_Undi_Recip 1127 0.47 1.03 0.14 166 TVD_RCVD_IP 1088 2.00 0.99 2.60 167 URI_NOVOWEL 1085 1.18 0.99 1.30 168 HTML_FONT_FACE_BAD 1080 0.71 0.99 0.54 169 RELAYCOUNTRY_FR 1045 0.45 0.95 0.14 170 XM_B_DNDMA 1045 0.63 0.95 0.43 171 MONEY_FROM_MISSP 1035 0.35 0.95 0.00 172 HTML_IMAGE_ONLY_28 1033 0.48 0.94 0.21 173 XM_UB99 1000 0.34 0.91 0.00 174 HTML_TEXT_INVISIBLE_FONT 971 0.52 0.89 0.31 175 RCVD_IN_RP_SAFE 956 1.38 0.87 1.68 176 XM_Combo_Sbj 953 0.44 0.87 0.18 177 RCVD_IN_IADB_LISTED 936 2.19 0.86 2.98 178 TR_XM_DK_SendGrid 919 0.92 0.84 0.98 179 XM_B_COPY_HTML 911 0.82 0.83 0.82 180 TR_XM_Base64_M1 904 0.70 0.83 0.63 181 TR_Mismatch_TLD_01 897 0.42 0.82 0.18 182 XM_E_VN 895 0.31 0.82 0.00 183 FILL_THIS_FORM 882 0.48 0.81 0.28 184 XM_UB60 879 0.33 0.80 0.05 185 XMClaimOffer 876 0.40 0.80 0.16 186 XM_OfRef7 874 0.37 0.80 0.11 187 TM2_M_OBFU_COMMENT 867 0.45 0.79 0.24 188 TooManyTo_002 863 1.10 0.79 1.29 189 TR_MetaPhish_Combo_01 832 0.72 0.76 0.70 190 XMSolicitRefs_4 831 0.29 0.76 0.02 191 TR_XM_Undi_Recip11 827 0.30 0.76 0.04 192 FONT_INVIS_MSGID 822 0.36 0.75 0.12 193 TR_XM_Spammywords 814 0.42 0.74 0.22 194 XM_S_SpammyWords 814 0.42 0.74 0.22 195 RCVD_IN_IADB_SPF 810 1.97 0.74 2.71 196 XM_H_PHPOS_M 808 0.32 0.74 0.06 197 GOOG_STO_IMG_NOHTML 806 0.41 0.74 0.21 198 TooManyTo_003 804 0.78 0.73 0.81 199 DKIM_ADSP_CUSTOM_MED 800 0.74 0.73 0.74 200 TooManyTo_004 788 0.67 0.72 0.63 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 153427 82.78 81.53 83.52 2 HTML_MESSAGE 150739 86.79 94.73 82.06 3 RELAYCOUNTRY_US 142891 77.05 75.80 77.79 4 DKIM_SIGNED 139264 80.99 89.68 75.81 5 XM_DK_Pass 137402 79.56 87.54 74.80 6 DKIM_VALID 136550 78.59 85.74 74.34 7 XM_B_Unicode 128452 76.21 86.75 69.93 8 DKIM_VALID_AU 116474 63.47 63.58 63.41 9 DCC_CHECK_NEGATIVE 105886 44.75 23.10 57.64 10 XMListUnsubscribeExists 104185 63.52 74.94 56.72 11 BAYES_50 101824 47.47 34.12 55.43 12 XM_B_Unicode3 82248 44.97 45.31 44.77 13 XM_B_SpammyWords 78512 54.69 74.75 42.74 14 DCC_CHECK 77774 55.24 76.88 42.34 15 HTML_FONT_LOW_CONTRAST 66470 36.12 36.01 36.19 16 LOC_TINY_FONT_1 54076 32.99 38.95 29.44 17 DKIM_VALID_EF 52196 29.97 32.57 28.41 18 FVGT_m_MULTI_ODD 49948 29.11 32.33 27.19 19 RCVD_IN_MSPIKE_H2 42335 23.05 23.06 23.05 20 XMSubLong 38734 20.82 20.38 21.09 21 T_TM2_M_HEADER_IN_MSG 36707 19.90 19.75 19.98 22 XM_B_SpammyWords2 36174 28.09 42.18 19.69 23 MIME_HTML_ONLY 35843 25.08 34.44 19.51 24 T_KAM_HTML_FONT_INVALID 34878 21.24 25.03 18.99 25 ALL_TRUSTED 33706 11.93 1.15 18.35 26 USER_IN_DEF_DKIM_WL 32297 12.28 3.39 17.58 27 TR_XM_DK_Unsub 29990 19.95 26.03 16.33 28 XM_Multi_Part_URI 29127 16.61 17.87 15.86 29 BAYES_60 22742 10.67 7.80 12.38 30 XM_DKIMWhitelistDomains 20542 7.03 0.06 11.18 31 UNPARSEABLE_RELAY 20037 12.10 14.10 10.91 32 XM_Evil_Numbers_Gen 16459 8.71 8.28 8.96 33 RCVD_IN_VALIDITY_SAFE 14920 7.01 5.13 8.12 34 XM_B_Unsub 14188 9.94 13.65 7.72 35 LotsOfNums_01 13777 6.60 5.08 7.50 36 MPART_ALT_DIFF 13459 6.68 5.59 7.33 37 XM_H_GMP 13425 6.18 4.29 7.31 38 RCVD_IN_VALIDITY_CERTIFIED 13326 6.14 4.28 7.25 39 BAYES_00 13140 4.64 0.41 7.15 40 XM_DK_Undo_02 13008 23.34 50.63 7.08 41 HTML_IMAGE_RATIO_02 12443 7.01 7.41 6.77 42 RCVD_IN_MSPIKE_WL 12260 9.11 13.21 6.67 43 RCVD_IN_MSPIKE_H3 12260 9.11 13.21 6.67 44 TR_XM_BayesUnsub 11924 9.03 13.28 6.49 45 T_TooManySym_01 11321 4.57 1.90 6.16 46 BAYES_99 11257 18.72 39.85 6.13 47 TR_XM_DK_Bayes 11211 3.95 0.33 6.10 48 TR_XM_DK_Bayes1 11156 3.93 0.33 6.07 49 MIME_HTML_MOSTLY 10973 5.12 3.69 5.97 50 BAYES_80 10914 7.08 9.00 5.94 51 BOTNET_IPINHOSTNAME 10885 8.99 14.12 5.93 52 TooManyTo_001 10639 5.58 5.23 5.79 53 XM_Body_Dirty_Words 10531 8.09 12.05 5.73 54 XMStrtUSub 10417 5.20 4.42 5.67 55 ANY_BOUNCE_MESSAGE 10287 3.95 1.17 5.60 56 BOUNCE_MESSAGE 10286 3.95 1.17 5.60 57 XM_B_SpammyWords3 9970 8.25 12.98 5.43 58 TR_XM_DK_Bayes2 9889 3.45 0.20 5.38 59 IN_ZIMBRA_NJ_WHITELIST 9571 3.29 0.07 5.21 60 LOTS_OF_MONEY 9283 7.95 12.81 5.05 61 XMSubMetaSx_00 9044 5.67 6.93 4.92 62 BAYES_999 8721 14.75 31.55 4.75 63 HTML_IMAGE_RATIO_04 8617 5.34 6.44 4.69 64 XM_UncommonTLD01 8614 5.62 7.19 4.69 65 XM_H_Long_From01 8273 4.45 4.35 4.50 66 XM_B_Phish_Phrases 7178 3.96 4.05 3.91 67 RELAYCOUNTRY_META 7135 11.43 24.10 3.88 68 BAYES_40 7108 2.97 1.45 3.87 69 INVALID_MSGID 6932 2.41 0.12 3.77 70 T_TooManySym_02 6796 2.58 0.71 3.70 71 BAYES_95 6629 4.44 5.83 3.61 72 TR_XM_SpammyWords4 6578 6.46 11.30 3.58 73 TO_MALFORMED 6374 2.18 0.01 3.47 74 XMNumbers 6081 3.39 3.52 3.31 75 SCC_BODY_URI_ONLY 5977 2.24 0.53 3.25 76 MIME_QP_LONG_LINE 5958 2.66 1.69 3.24 77 FSL_BULK_SIG 5535 5.44 9.52 3.01 78 RCVD_IN_IADB_LISTED 5471 2.19 0.86 2.98 79 HTML_IMAGE_RATIO_06 5398 3.93 5.60 2.94 80 XM_B_SpammyTLD 5291 3.56 4.69 2.88 81 FROM_EXCESS_BASE64 5221 2.62 2.26 2.84 82 BAYES_05 5019 1.88 0.46 2.73 83 BAYES_20 4994 2.11 1.08 2.72 84 RCVD_IN_IADB_SPF 4970 1.97 0.74 2.71 85 TR_DCC_Bayes_99 4793 12.95 30.31 2.61 86 TVD_RCVD_IP 4777 2.00 0.99 2.60 87 TR_XM_DKIM_Undo 4642 16.99 41.27 2.53 88 TR_XM_SpammyRelay 4636 9.26 20.57 2.52 89 RCVD_IN_IADB_SENDERID 4590 1.83 0.71 2.50 90 T_REMOTE_IMAGE 4521 2.15 1.62 2.46 91 RCVD_IN_IADB_DK 4495 1.80 0.72 2.45 92 MIME_HTML_ONLY_MULTI 4491 2.89 3.64 2.44 93 T_XMDrugObfuBody_14 4334 2.87 3.73 2.36 94 HTML_EXTRA_CLOSE 4219 1.45 0.02 2.30 95 MISSING_MIMEOLE 4129 1.41 0.00 2.25 96 XMBSHREFv2 4112 1.49 0.23 2.24 97 XM_CamelCaseFrm001 4090 2.44 2.80 2.23 98 XM_SPF_SoftFail 3977 2.84 3.97 2.17 99 HTML_IMAGE_RATIO_08 3803 2.48 3.17 2.07 100 XMSexyCombo_05 3756 3.54 6.06 2.04 101 TR_XM_PhishingBody 3602 2.65 3.82 1.96 102 TM2_M_URI_OPT_OUT 3589 2.45 3.28 1.95 103 TR_XM_UnparsRelay 3585 4.16 7.85 1.95 104 UNTRUSTED_Relay 3555 3.46 6.02 1.94 105 XM_PDF 3430 1.24 0.20 1.87 106 TVD_SPACE_RATIO 3386 1.20 0.11 1.84 107 RCVD_IN_IADB_VOUCHED 3310 1.26 0.36 1.80 108 IN_HORDE_ADDRESS_BOOK 3246 1.13 0.05 1.77 109 MAILING_LIST_MULTI 3227 1.62 1.38 1.76 110 XMStockSpam_06 3152 1.71 1.71 1.72 111 RCVD_IN_RP_SAFE 3080 1.38 0.87 1.68 112 T_XMDrugObfuBody_08 3052 2.07 2.76 1.66 113 XMGappySubj_01 3049 1.09 0.13 1.66 114 XM_DK_Undo_01 3040 1.46 1.14 1.65 115 RELAYCOUNTRY_CA 2964 6.91 15.79 1.61 116 XMDiploma_00 2859 1.63 1.75 1.56 117 TR_XM_SpammyWords5 2841 2.93 5.25 1.55 118 XMSubMetaI_00 2788 1.59 1.70 1.52 119 TM2_M_VERY_LONG_WORD 2769 2.07 3.00 1.51 120 XMBody_95 2764 0.97 0.08 1.50 121 RCVD_IN_RP_CERTIFIED 2729 1.19 0.71 1.49 122 DKIM_INVALID 2714 2.40 3.94 1.48 123 XMBdyGiftCard01 2675 1.47 1.50 1.46 124 XMGappySubj_02 2620 0.90 0.03 1.43 125 RCVD_IN_IADB_OPTIN 2455 0.92 0.22 1.34 126 URI_NOVOWEL 2381 1.18 0.99 1.30 127 MSGID_NOFQDN1 2375 0.82 0.02 1.29 128 XM_SendGrid 2368 1.27 1.24 1.29 129 TooManyTo_002 2361 1.10 0.79 1.29 130 XM_B_Investor 2336 2.17 3.67 1.27 131 XM_GoogleGroups 2283 0.95 0.47 1.24 132 T_TooManySym_03 2279 0.88 0.27 1.24 133 MPART_ALT_DIFF_COUNT 2208 1.46 1.88 1.20 134 URI_HEX 2099 1.25 1.43 1.14 135 HTML_MIME_NO_HTML_TAG 2088 1.25 1.43 1.14 136 BOTNET 2059 4.23 9.46 1.12 137 XM_UB50 1916 1.53 2.35 1.04 138 XM_RXBody 1896 0.86 0.57 1.03 139 XM_B_Unsub2 1868 1.21 1.53 1.02 140 TR_Symld_Words 1860 0.85 0.57 1.01 141 TR_XM_DK_SendGrid 1792 0.92 0.84 0.98 142 XMPhish30 1789 1.43 2.20 0.97 143 USER_IN_WELCOMELIST 1741 0.59 0.00 0.95 144 USER_IN_WHITELIST 1741 0.59 0.00 0.95 145 SUBJ_ALL_CAPS 1724 1.72 3.04 0.94 146 XM_B_SpammyWords4 1700 1.55 2.60 0.93 147 XM_H_PHPMailer 1634 1.01 1.21 0.89 148 XMBody_17 1614 3.45 7.78 0.88 149 XM_OfRef6 1583 2.46 5.15 0.86 150 XM_H_Long_From02 1579 0.97 1.15 0.86 151 XM_H_Trusted_IP 1537 0.52 0.00 0.84 152 XM_B_COPY_HTML 1498 0.82 0.83 0.82 153 T_XMHurry_00 1483 1.51 2.70 0.81 154 TooManyTo_003 1482 0.78 0.73 0.81 155 DKIM_ADSP_CUSTOM_MED 1360 0.74 0.73 0.74 156 XM_ProductURIs 1346 0.91 1.20 0.73 157 XMSubNoVowel 1315 0.62 0.45 0.72 158 XMSubMetaSxObfu_02 1310 0.52 0.18 0.71 159 TR_MetaPhish_Combo_01 1282 0.72 0.76 0.70 160 RCVD_IN_BL_SPAMCOP_NET 1270 6.70 16.79 0.69 161 THIS_AD 1229 1.01 1.59 0.67 162 URI_TRY_3LD 1225 1.03 1.65 0.67 163 TR_XM_SpammyWords2 1223 6.34 15.85 0.67 164 XM_B_REG_HTML 1185 0.63 0.60 0.65 165 TR_LOTS_OF_MONEY3 1183 1.78 3.70 0.64 166 HTML_TAG_BALANCE_BODY 1169 1.17 2.05 0.64 167 TooManyTo_004 1166 0.67 0.72 0.63 168 TR_XM_Base64_M1 1161 0.70 0.83 0.63 169 XMLngstWrd_00 1126 0.56 0.48 0.61 170 SUBJ_DOLLARS 1094 0.60 0.61 0.60 171 PLING_QUERY 1034 0.62 0.71 0.56 172 XMGenDplmaNmb 1019 0.58 0.61 0.55 173 TooManyTo_005 1001 0.60 0.69 0.54 174 HTML_FONT_FACE_BAD 995 0.71 0.99 0.54 175 SpammyFromTLD_01 993 2.02 4.49 0.54 176 T_XMDrugObfuBody_00 973 0.75 1.11 0.53 177 DKIM_ADSP_NXDOMAIN 955 0.46 0.35 0.52 178 XMBrknScrpt_02 926 1.32 2.69 0.50 179 NML_ADSP_CUSTOM_MED 900 0.56 0.67 0.49 180 XM_Ancestry_Forge 889 0.31 0.01 0.48 181 HTTPS_HTTP_MISMATCH 873 0.73 1.16 0.48 182 KHOP_HELO_FCRDNS 866 1.07 2.07 0.47 183 XMPhish14 862 0.53 0.62 0.47 184 FORGED_GMAIL_RCVD 842 0.54 0.66 0.46 185 T_TooManySym_04 832 0.33 0.14 0.45 186 XMHTML_After_End 831 0.47 0.50 0.45 187 RCVD_IN_IADB_OPTIN_GT50 826 0.30 0.06 0.45 188 SHOPIFY_IMG_NOT_RCVD_SFY 812 0.82 1.45 0.44 189 XMNoVowels 808 0.43 0.42 0.44 190 XM_B_DNDMA 789 0.63 0.95 0.43 191 XM_S_SubURI 754 0.27 0.04 0.41 192 DIET_1 753 0.81 1.49 0.41 193 RCVD_IN_PSBL 751 1.05 2.13 0.41 194 XMSubMetaSxObfu_03 736 0.47 0.58 0.40 195 RELAYCOUNTRY_AU 732 1.17 2.47 0.40 196 MSGID_FROM_MTA_HEADER 728 0.27 0.06 0.40 197 T_FILL_THIS_FORM_SHORT 727 2.39 5.74 0.40 198 CTE_8BIT_MISMATCH 721 0.25 0.02 0.39 199 RELAYCOUNTRY_DE 703 0.47 0.61 0.38 200 HTML_TEXT_INVISIBLE_STYLE 687 0.40 0.45 0.37 ----------------------------------------------------------------------